Thursday, June 9, 2011

Memory disclosure technique for Internet Explorer

Memory disclosure became an important part of exploit development in the light of various protection mechanisms. The ability to read memory holds multiple benefits for exploit developers. The most obvious one is, of course, the ability to circumvent ASLR - if we can read the content of the memory, we can determine the address of an module, for example by reading a vtable pointer of some object and subtracting a (constant) offset. However, memory disclosure brings additional benefits as well. For example, many exploits rely on a speciffic (predictable) memory layout. If we can read memory, we do not have to make any guesses regarding the memory layout. Thus, memory disclosure can also be used to improve the reliability of exploits and enable the exploit development in conditions where the memory layout is unpredictable.

One technique for memory desclosure was used by Peter Vreugdenhil in the Pwn2Own 2010 contest (http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf). This technique consists of overwtiting a terminator of a string, which enables reading the memory immediately after the end of the string. This was enough to defeat ASLR, however, in general, it has a disadvantage that it can only read the memory up to the next null-character (that will be interpreted as the new string terminator). Additionally, there is no way to read past the end of currnet memory block (except if the next memory block begins immediately after the current block, with no unreadable memory in between).

The technique I propose here enables reading a much wider area of memory and also reading memory in other memory blocks, with unreadeable memory in between them. The technique itself is very simple, however, since I never saw anyone using or describing it, I decided to describe it here. I successfully used this technique in various exploits for Internet Explorer, most recently in an exploit for a vulnerability in Internet Explorer 8 on Windows 7.

The main idea of this technique is to overwrite the DWORD holding the length of a JavaScript string.

Background: JavaScript strings

JavaScript strings in Internet Explorer are stored in memory in the following form:

[string length in bytes][sequence of 16-bit characters]

So, for example, the string 'aaaa' will be stored as (hex):

08 00 00 00 61 00 61 00 61 00 61 00

If we overwrite the DWORD holding the string length, we can peek at the memory past the end of the string.

Assume we successfullty overwrote the length of string 'str'. By calling for example

mem = str.substr(offset/2,size/2);

we can obtain (in a string 'mem' of size 'size') the content of memory at address [address of str] + offset.

We can read any memory address provided that the offset+size is less than the new string length. Thus, the address we can read up to is only limited by the value we can overwrte string length with.

How to overwrite sting length?

The method we can use to overwrite string length will depend heavily on the vulnerablity we are exploiting. Here, I'll go through some of the most common vulnerability classes and show how they can be used to overwrite the length of a string.

1. Heap overflow: This is probably the simplest one. Allocate a string after the buffer you can overwrite. By overwriting the memory past the buffer, you'll also overwrite string length.

2. Double free: This consists of several steps: a) Free some object in memory, b) allocate a string in its place (make sure it has the same initial size as the deleted object), c) free the object again. Here we are exploiting the way how malloc and free work in windows: after a block is freed, its first DWORD will hold an address of the next free memory block of the same size or, if no such block exists, it will point back to the heap header. In both cases, the string lenght is overwritten with a large value.

3. Use-after-free: See if this vulnerability can be used to make double free. If it can, see point no. 2. If not, see if any property of the deleted object can be changed. If yes, try to allocate strings in memory so that the length of some string gets aligned with this property of the deleted object. Then change said property. Another way is to try to leverage the vulnerability into arbitrary memory address overwrite and see case no. 6.

4. Stack overflow: This is a difficult one, as JavaScript strings are allocated on the heap and not stack. However, note that stack overflow does not mean you absolutely have to overwrite the return address of the current function. Sometimes it is possible to overwrtite some address stored on the stack in between the buffer and the return address of the curent function and in this way leverage the the vulnerability into arbitrary memory address overwrite. If you can accomplish this, see case no. 6.

5. Integer overflow: This vulnerability class can be made to behave as either a) heap overflow (integer calculations are used to calculate the size of the buffer, in this case see case no. 1) or b) Arbitrary memory address overwrite (integer calculations are used to calculate the address of the buffer, in this case see case no. 6)

6. Arbitrary memory address overwrite: Many of the previous vulnerability classes (and many others, such as loop condition bugs) can be leveraged into arbitrary memory address overwrite. This case will be discussed in detail (with example code) in the next section.

Overwriting string length with arbitrary memory address overwrite

Suppose we have a JavaScript method OverwriteOffset(offset) that exploits some vulnerability to overwrite a memory at the address [address of some object]+offset with a large number. If we had a method OverwriteAbsolute(address) that overwrites the address 'address' with a large number, the analysis would be similar. However, since, in general, the first case is more difficult (as we don't know the absolute addresses) it will be discussed here.

The task in question is to use OverwriteOffset(offset) to overwrite the length of some string. However lets allso suppose that we don't know (and can't guess) the address (nor the offset) of any string.

In order to make things more predictable we will use heap spraying. So, suppose we made a heap spray that is stored in an array 'spray'. Each element of the array is a string with approximately 1MB size. Each such string will be allocated in a separate memory block of size 0x100000. We can use the following code to accomplish this.

The inttostr function used above converts an integer into four-byte string. This way, each string will contain its index in the first two characters. We'll come back to why I did this later.

With a heap spray as above we'll have a large probability that offset+0x100000*100 will fall somewhere in the spray. We don't know exactly where this address falls in our heap spray, however once we do the overwrite we can easily determine that as follows:

1. Overwrite a memory location somewhere in the sprayed part of the memory

2. Find out which sting we overwrote by comparing each string with its neighbor

3. Find out which characters in the string we overwrote by comparing string parts with what they originally contained. Use binary search and substr methods to speed up the process.

4. We can now calculate the offset of the string length. Overwrite the string length.

However, we would also like to determine the absolute address of the string, so instead of ofsets, we can provide absolute adresses to our ReadMem function. This will be discussed in the next section.

Determining the absolute address of the string

To determine the absolute address of the string we'll exploit the fact that each string in our heap spray is allocated in a separate memory block. We also know the size of such memory blocks (0x100000) and can assume that the next memory block comes immediately after the current one in memory.

Each memory block starts with a header. This header, among other things contains the address of the previous and the next memory block. So, memory block looks like:

[address of the next memory block][address of the previous memory block][24 bytes of some other header data][data]

So if we assume that the strings are placed in blocks in the following order

we can determine the absolute address of the string in the following way, by reading the previous block pointer of the block that immediately follows the one that holds the ovrwritten string

readaddr = ReadMem(0x100000-0x20)+0x24;

This technique relies on the correct order of memory blocks. This order will usually be correct if the exploit is launched in a 'clean' Internte Explorer process (for example, if the exploit is opened in a new browser tab or window). However, in general, this does not have to be the case, so the memory could look like, for example

However, although the order of blocks in memory may appear scrambled, the next block pointer of block containing string n will still point to the block containing string n+1. Similarly, the previous block pointer of block containing string n will still point to the block containing string n-1. Now remember that we made our heap spray so that each string contains its index in the first two characters. We can exploit this information to determine the correct absolute string address as follows:

Why use binary search to find the index of the changed byte? It still takes O(n) byte comparisons. Actually, this particular "binary search" seems to require O(n log n) comparisons. I may be missing something, but wouldn't a simple linear scan be faster?

I don't think it would. Remember that you need to find the exact byte (or, in my case, DWORD) that was changed.Theoretically, you could go DWORD by DWORD and examine if it was changed. This would be an O(n) algorithm, but this would also mean making several tens of millions JavaScript calls (one call for each possible DWORD). This would be very slow (espacially on IE8).Instead I first find the string that was changed, next divide it in half and see which part was changed, then divide this part in two etc. Note that this is actually not an O(n*log(n)) algorithm (although it may appear so), but instead an O(n) algorithm (try and count the number of bytes examined, it is halved each time so you have n+n/2+n/4+n/8... = 2n-1). So it's also an O(n) algorithm, but it requires only O(log(n)) JavaScript calls.

Hello there, just became aware of your blog through Google, and found that it is truly informative. I am gonna watch out for brussels. I will appreciate if you continue this in future. Numerous people will be benefited from your writing. Cheers!

Hello Everybody,My name is Mrs Sharon Sim. I live in singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) +918376918351 Thank you.

Hello Everybody,My name is Mrs.Irene Query. I live in Philippines and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of $150,000.00 to start my life all over as i am a single mother with 2 kids I met this honest and GOD fearing man loan lender that help me with a loan of$150,000.00 US. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs.Irene Query, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) Thank you.

Hello Everybody,My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) Thank you.

$$$ GENUINE LOAN WITH 3% INTEREST RATE APPLY $$$.Are you in need of a Loan to pay off your debt and start a new life? You have come to the right place were you can get your loan at a very low interest rate. Interested people/company should please contact us via email for more details.

Hello Everybody,My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) Thank you.

Hello Everybody,My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) Thank you.

Hello Everybody,My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) Thank you.

Hello Everybody,My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(abubakarloanservice@gmail.com) Thank you.

Hello Everybody,My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) Thank you.

I am a private loan lender which have all take to be a genuine lender i give out the best loan to my client at a very convenient rate.The interest rate of this loan is 3%.i give out loan to public and private individuals.the maximum amount i give out in this loan is $1,000,000.00 USD why the minimum amount i give out is 5000.for more information contact us email honestloan10@gmail.comYour Full Details:Full Name :………Country :………….state:………….Sex :………….Address............Tel :………….Occupation :……..Amount Required :…………Purpose of the Loan :……..Loan Duration :…………Phone Number :………Contact email:honestloan10@gmail.comWebsite;http://honestloan.ulcraft.com/

Do you need Finance?Are you looking for Finance?Are you looking for a money to enlarge your business?We help individuals and companies to obtain loan for businessexpanding and to setup a new business ranging any amount. Get a loan at affordable interest rate of 3%, Do you need this cash/loan for business and to clear your bills? Then send us an email now for more information contact us now via Email:maxcreditfinance@googlemail.com

My Brothers and Sister all over the world, I am Mrs Boo Wheat from Canada ; i was in need of loan some month ago. i needed a loan to open my restaurant and bar, when one of my long time business partner introduce me to this good and trustful loan lender DR PURVA PIUS that help me out with a loan, and is interest rate is very low , thank God today. I am now a successful business woman, and I became useful. In the life of others, I now hold a restaurant and bar. And about 30 workers, thank GOD for my life I am leaving well today a happy father with three kids, thanks to you DR PURVA PIUS Now I can take care of my lovely family, i can now pay my bill. I am now the bread winner of my family. If you are look for a trustful and reliable loan leader. You can Email him via,mail (urgentloan22@gmail.com) Please tell him Mrs Boo Wheat from Canada introduce you to him. THANKS

I'm Isabella Tyson from 1910 N Halsted St Unit 3, Chicago IL60614 USA,, i have been searching for a genuine loan company for the past few months and all i got was bunch of scams who made me to trust them and at the end of the day took my money without giving anything in return, all hope was lost i got confused and frustrated, i find it very difficult to feed my family and vowed never to have anything to do with loan companies on net and went to seek of assistance from a very good friend which i explained all my experience regarding online companies with and said he can help me that he knows of a Godsent and well known company called FUNDING CIRCLE PLC, he stated he just got a loan from them although i was still very unsure about this company due to my past experience but i decided to give it a try and did as i was directed by my friend and applied, i never believed but i tried and to my greatest surprise i received my loan in my bank account within 24 hours, i could not believe that i would stand on my feet financially again. I’m glad I took the risk and applied for the loan and today i'm thanking God that such loan companies still exist and promise to share the good news to people who are in need of financial assistance because the rate of scams on net is getting very serious and i don't want people to fall victim when we still have genuine and Godsent lenders.. You can contact this Godsent company using the information as stated and be a partaker of this great testimony.. Email: fundingloanplc@yahoo.com OR Call/Text +14067326622 thanks

Hello Everybody,My name is Ahmad Asnul Brunei, I contacted Mr Osman Loan Firm for a business loan amount of $250,000, Then i was told about the step of approving my requested loan amount, after taking the risk again because i was so much desperate of setting up a business to my greatest surprise, the loan amount was credited to my bank account within 24 banking hours without any stress of getting my loan. I was surprise because i was first fall a victim of scam! If you are interested of securing any loan amount & you are located in any country, I'll advise you can contact Mr Osman Loan Firm via email osmanloanserves@gmail.com

We are a professional SEO company in Dubai. Our aim is to help you in growing your business online. We’re expert in organic SEO Dubai, we do our best to get your website ranked on your keywords as soon as possibleSEO Dubai

Do you need a quick long or short term loan with a relatively low interest rate as low as 3%? We offer business loan, personal loan, home loan,auto loan, student loan, debt consolidation loan e.t.c. no matter your credit score. We are guaranteed in giving out financial services to our numerous clients all over world. With our flexible lending packages, loans can be processed and transferred to the borrower within the shortest time possible, contact our specialist for advice and finance planning. If you need a quick loan contact us at: Email :trivagofinancialhome.in@gmail.com call or WhatsApp us +1 (315) 615-2883 for more info.

Do you need a financial help? Are you in any financial crisis or do you need funds to start up your own business? Do you need funds to settle your debt or pay off your bills or start a good business? Do you have a low credit score and you are finding it hard to obtain capital services from local banks and other financial institutes? Here is your chance to obtain a financial services from our company. We offer the following finance to individuals-*Commercial finance*Personal finance*Business finance*Construction finance*Business finance And many More:and many more at 3% interest rate;Contact Us Via Email: (trivagofinancialhome.in@gmail.com) call/WhatsApp us +1(315)615-2883 for more info.

HELLO,God bless you sir, I will not stop telling the world about your kindness in my life, Am Mrs Cynthia corvin . A lady with a great testimony I live in USA and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave happiness to me and my family, i was in need of a loan of $360,000.00 to start my life all over as i am a mother with 2 kids I met this honest and GOD fearing man loan lender that help me with a loan of $360,000.0.Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs cynthia corvin, that refer you to him. contact Mr.Zak,via email:- feroozsuptoo@outlook.com

Do you need a Loan?Are you looking for Finance?Are you looking for a Loan to enlarge your business?I think you have come to the right place.We offer Loans atlow interest rate.Interested people should please contact us onFor immediate response to your application, Kindlyreply to this emails below only.Whats app +919205646839neadneadloan@gmail.com

Do you need a Loan?Are you looking for Finance?Are you looking for a Loan to enlarge your business?I think you have come to the right place.We offer Loans atlow interest rate.Interested people should please contact us onFor immediate response to your application, Kindlyreply to this emails below only.Whats app +919205646839neadneadloan@gmail.com

Do you need Finance?Are you looking for Finance?Are you looking for a money to enlarge your business?We help individuals and companies to obtain loan for businessexpanding and to setup a new business ranging any amount. Get a loan at affordable interest rate of 3%, Do you need this cash/loan for business and to clear your bills? Then send us an email now for more information contact us now via Email:maxcreditfinance@googlemail.com

Do you need Finance?Are you looking for Finance?Are you looking for a money to enlarge your business?We help individuals and companies to obtain loan for businessexpanding and to setup a new business ranging any amount. Get a loan at affordable interest rate of 3%, Do you need this cash/loan for business and to clear your bills? Then send us an email now for more information contact us now via Email:maxcreditfinance@googlemail.com

Hey Thanks for sharing this valuable information with us. I will come back to your site and keep sharing this information with us. I must say that if you are interested in FMCdealer quick step by step login guide to ford employees then do visit FMC Dealer Direcrt Official Website fmcdealer

The most authentic post ever i read about this topic so far i must say you have cleared all the required info thank for sharing, keep up the good work and find best e-ticket, visa and travel insurance services at Malik Express.

We Offers Financial Consulting To Client, Companies Seeking Debt / Loan Financing And Seeking For Working Capital To Start A New Business Or To Expand Existing Business. Interested Parties Should Contact Us For More Information Through Via E-mail: susan.credit@hotmail.com

Do You Need A Loan To Consolidate Your Debt At 1.0%? Or A Personal Loans * Business Loans etc. Interested Parties Should Contact Us For More Information Through Via E-mail: susan.credit@hotmail.com

We Have Loan Programs Tailored For Any Profile And You've Come To The Right Place To Satisfy Your Business Needs. If Your Company Or You Know Of Any Company With Viable Projects / Proposals That Needs Financing, Kindly Write Us With The Loan Requirement. Please, Contact Us For More Information: susan.credit@hotmail.com

Do You Need A Loan To Consolidate Your Debt At 1.0%? Or A Personal Loans * Business Loans etc. Interested Parties Should Contact Us For More Information Through Via E-mail: susan.credit@hotmail.com

We Offers Financial Consulting To Client, Companies Seeking Debt / Loan Financing And Seeking For Working Capital To Start A New Business Or To Expand Existing Business. Interested Parties Should Contact Us For More Information Through Via E-mail: susan.credit@hotmail.com

Kindly write us back with the loan information;- Complete Name:- Loan amount needed:- Loan Duration:- Purpose of loan:- City / Country:- Telephone:- How Did You Hear About Us:

Do You Need A Loan To Consolidate Your Debt At 1.0%? Or A Personal Loans * Business Loans etc. Interested Parties Should Contact Us For More Information Through Via E-mail: susan.credit@hotmail.com

We Offers Financial Consulting To Client, Companies Seeking Debt / Loan Financing And Seeking For Working Capital To Start A New Business Or To Expand Existing Business. Interested Parties Should Contact Us For More Information Through Via E-mail: susan.credit@hotmail.com

Hello everyone. I saw comments from people who already got their loan from Jackson Walton Loan Company, honestly i thought it was fake , and then I decided to apply under their recommendations and just few days ago I confirmed in my own personal bank account a total amount of $10,000 which I requested for. This is really a great news and i am so happy, I am advising everyone who needs real loan to apply through their email (Text or Call +1-586-331-5557) (jacksonwaltonloancompany@gmail.com) They are capable of given you your loan thanks.

well, you have written a masterpiece and i must appreciate the work you are doing. You are spreading this type of information which is very much valuable for the people. Much Appreciated. Keep posting this type of information.Seo Expert in Pakistan

search engine optimisation and cyber Security hot topics of the world. I found your information really useful. I would like to say thanks once again for this information. keep posting all the new information.

We offer a variety of Financial packages at a very low interest rate, We stand apart from other lenders because we believe in customer service, We offer the right solution to your financial needs.In general we are FINANCE COMPANY, We offer loan at 3% interest rate, Commercial loans, business loans, home loans, car loans and debt consolidation loan are available for you. Contact us for more information via E-MAIL: collinsguzmanfundings@gmail.com

Treg Finance Limited provides personal loans/business loans/trade finance/import & export loans/project loans to companies of all sizes ranging from individuals, companies and trader's globally. Just one simple process, We make financing the growth of your business simple, transparent, and fair.

No jargon, no hidden feesSimple approval processFast business loans funded in just 2-3 business daysLow Interest rate of 2% Companies can be profitable or have negative net incomePrior bankruptcies acceptedZero credit checks requiredIndividuals with Bad credit can applyFlexible repayment schedulesCIS & KYC required for all loan applicant irrespective of location/countryLoan Duration from 1 year - 20 years maximumGrace period of 12 - 24 months for large business loans/working capitalLoan Funding/Financing is not limited to any geographical location or country whatsoever

We build just the right financing for each client, with simple paperwork, quick approvals, and flexible payment schedules. For further details, Kindly contact us via email, telephone, Skype. Intermediaries/Consultants/Brokers are welcome to bring their clients and are 100% protected. In complete confidence, we will work together for the benefits of all parties involved, Looking forward to rendering the best of our services to all esteemed clientele globally.

Treg Finance Limited provides personal loans/business loans/trade finance/import & export loans/project loans to companies of all sizes ranging from individuals, companies and trader's globally. Just one simple process, We make financing the growth of your business simple, transparent, and fair.

No jargon, no hidden feesSimple approval processFast business loans funded in just 2-3 business daysLow Interest rate of 2% Companies can be profitable or have negative net incomePrior bankruptcies acceptedZero credit checks requiredIndividuals with Bad credit can applyFlexible repayment schedulesCIS & KYC required for all loan applicant irrespective of location/countryLoan Duration from 1 year - 20 years maximumGrace period of 12 - 24 months for large business loans/working capitalLoan Funding/Financing is not limited to any geographical location or country whatsoever

We build just the right financing for each client, with simple paperwork, quick approvals, and flexible payment schedules. For further details, Kindly contact us via email, telephone, Skype. Intermediaries/Consultants/Brokers are welcome to bring their clients and are 100% protected. In complete confidence, we will work together for the benefits of all parties involved, Looking forward to rendering the best of our services to all esteemed clientele globally.

Treg Finance Limited provides personal loans/business loans/trade finance/import & export loans/project loans to companies of all sizes ranging from individuals, companies and trader's globally. Just one simple process, We make financing the growth of your business simple, transparent, and fair.

No jargon, no hidden feesSimple approval processFast business loans funded in just 2-3 business daysLow Interest rate of 2% Companies can be profitable or have negative net incomePrior bankruptcies acceptedZero credit checks requiredIndividuals with Bad credit can applyFlexible repayment schedulesCIS & KYC required for all loan applicant irrespective of location/countryLoan Duration from 1 year - 20 years maximumGrace period of 12 - 24 months for large business loans/working capitalLoan Funding/Financing is not limited to any geographical location or country whatsoever

We build just the right financing for each client, with simple paperwork, quick approvals, and flexible payment schedules. For further details, Kindly contact us via email, telephone, Skype. Intermediaries/Consultants/Brokers are welcome to bring their clients and are 100% protected. In complete confidence, we will work together for the benefits of all parties involved, Looking forward to rendering the best of our services to all esteemed clientele globally.

We offer real credit services to the general public, in order to improve mankind and save those who have bad credit. Credits We have certified and 100% reliable. We make sure that our customers are dealing with every encouragement with the best resources. Our service credit is very easy and effective. For more details about our credit, please contact us via e-mail: farhancredit247@gmail.com

Phone: +919900497696whatsapp: +1 (307)216-4782

Regards,Mr. Aziz.

We offer real credit services to the general public, in order to improve mankind and save those who have bad credit. Credits We have certified and 100% reliable. We make sure that our customers are dealing with every encouragement with the best resources. Our service credit is very easy and effective. For more details about our credit, please contact us via e-mail: farhancredit247@gmail.com

About Me

Ivan Fratric currently works as an information security engineer at a large software company. Before that, he was a research and teaching assistant at the University of Zagreb and a security enthusiast, as documented on this blog.

The opinions expressed herein are my own and do not represent my employer’s views in any way.